diff --git a/roles/serveur_keycloak/tasks/federation-ldap.yml b/roles/serveur_keycloak/tasks/federation-ldap.yml
index 8054784..2fe417b 100644
--- a/roles/serveur_keycloak/tasks/federation-ldap.yml
+++ b/roles/serveur_keycloak/tasks/federation-ldap.yml
@@ -10,8 +10,9 @@
 
 - name: Configurer le realm et la fédération LDAP (kcadm, idempotent)
   ansible.builtin.shell:
+    executable: /bin/bash
     cmd: |
-      set -eu
+      set -euo pipefail
       KC={{ serveur_keycloak_home }}/bin/kcadm.sh
       CHANGED=0
       "$KC" config credentials --server http://localhost:8080 --realm master \